GDPR Compliant

Privacy Policy

Last updated: April 1, 2026 · Prepared in compliance with GDPR

At TulparAI, we take the privacy of your personal data seriously. This policy explains what data we collect, why, how we process it, and your rights.

Table of Contents

Personal Data Processed

Data	Purpose	Legal Basis
Email, Full name	Account creation, login, notifications	Contract performance (Art. 6(1)(b))
Profile photo (URL)	User profile	Contract performance (Art. 6(1)(b))
Hashed password	Authentication	Contract performance (Art. 6(1)(b))
Instagram DM content	AI-powered automated reply generation	Explicit consent (Art. 6(1)(a))
Payment info (Stripe)	Subscription management	Contract performance (Art. 6(1)(b))
IP address, logs	Security and error detection	Legitimate interest (Art. 6(1)(f))

Account dataUntil account deletion

Instagram DM history90 days

IP & audit logs2 years

Analytics data1 year

International data transfers occur to the following parties under GDPR Article 44+:

OpenAI — USAExplicit Consent Required

Instagram DM messages are sent to OpenAI's US servers for AI (GPT-4o) processing. This transfer only occurs with your explicit consent.

Stripe — USAContractual Necessity

Payment information is sent to Stripe's US servers for subscription management. Stripe is PCI DSS Level 1 certified.

Right of Access: Learn whether your personal data is processed and which data

Right to Rectification: Request correction of incorrect or incomplete data

Right to Erasure: Request deletion of data

Right to Object: Object to results of automated systems

To exercise your rights or for questions about your personal data, please contact:

Data Controller

TulparAI

Email: kvkk@tulparai.app

Requests will be answered free of charge within 30 days.